Running IPv6-only
IPv4 addresses are scarce and expensive. IPv6 is free and abundant. The gap between those two facts is where the practical difficulties live.
Where IPv6-only works today
- Internal services — databases, caches, monitoring, log shipping between your own machines. Nothing outside needs to reach them, so give them v6 and be done.
- Kubernetes and container networks, where the addresses are internal anyway.
- Build and CI machines, provided your package mirrors and registries are reachable over v6 — check, because several are not.
Where it still does not
Anything the public reaches. A meaningful share of users, and a long tail of corporate networks, remain IPv4-only. A public website on v6 alone is unreachable for them, and they will not know why.
Outbound is just as awkward: payment providers, webhook endpoints, SMTP relays and third-party APIs are frequently v4-only. An IPv6-only machine that needs to call them needs a translation layer.
NAT64 and DNS64
The standard way to let an IPv6-only machine reach IPv4 services. DNS64 synthesises an IPv6 address for a v4-only name; NAT64 translates the traffic at a gateway.
It works well for ordinary client traffic and badly for anything that carries literal IP addresses inside the protocol, or that pins certificates to addresses. Test your actual dependencies rather than assuming.
If you want this on our network, talk to us first — it is a design question, not a checkbox.
The pragmatic position
Dual-stack public, IPv6-only internal. Your public endpoints get one v4 address each and full v6; everything behind them talks v6 only. You spend a handful of scarce addresses instead of dozens, and nothing is unreachable.
IPv6 is supported everywhere on our network and is not an afterthought, so the v6 half costs you nothing. See IPv6 on your server and additional addresses and routed subnets.
Checks before you commit
- Does every outbound dependency answer over v6? Test with
curl -6against each one. - Do your package repositories and container registries?
- Does your monitoring reach the host over v6, and does it alert if only one protocol is broken?
- Is reverse DNS set for the v6 addresses too? Mail in particular needs it — see reverse DNS.
- Do your firewall rules exist in both families?
nftwith theinetfamily covers both at once; iptables and ip6tables do not.
That last one is the classic error: a carefully firewalled machine, wide open over IPv6 because the rules were only ever written for v4. Check it from outside, in both families, every time.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base